Target label attack method and equipment oriented to longitudinal federated reasoning system, and medium

Abstract

The invention discloses a target label attack method and device oriented to a longitudinal federated reasoning system and a medium, and belongs to the field of artificial intelligence system security, and the method comprises the steps: dividing the reasoning process of an attacker into a preparation stage, enabling the attacker to normally execute a longitudinal federated reasoning process, accumulating the reasoning result fed back from a global longitudinal federated model as a pseudo label, and carrying out the processing of the pseudo label; training a local substitution model locally by using a pseudo tag, and estimating a detector in the global longitudinal federated reasoning system; and an attack stage: optimizing input sample features by using a projection gradient descent method to generate malicious samples, and inputting the generated malicious samples into a federal reasoning system to carry out target label attack. According to the method, the output result of the reasoned sample can be accumulated in the reasoning process to serve as the pseudo tag, and therefore the situation that an attacker must obtain the sample tag to achieve effective target tag attack is avoided.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence system security technology, and in particular to a target label attack method for a vertical federated reasoning system. Background Art

[0002] Vertical federated reasoning systems allow multiple data participants to collaborate on reasoning tasks. However, in practical applications, some participants may engage in malicious behavior, providing malicious sample features that could compromise system security and lead to erroneous reasoning output. To address the vulnerabilities of vertical federated reasoning systems, various techniques have been developed to attack the system from different angles for vulnerability verification. These techniques typically construct a shadow model locally at the attacker's site, optimize input features, and cause the shadow model to output the target label. This optimized feature vector is then fed into the global vertical federated reasoning model, causing the global model to also output the target label.

[0003] However, these techniques typically assume that the attacker has access to the probability vector output by the global vertical federated reasoning system, or that the attacker has access to data samples with real labels. These assumptions are often difficult to achieve in real scenarios. In addition, existing technologies ignore the detector module that may exist in the global vertical federated reasoning system. The role of this detector module is to monitor the malicious sample characteristics provided by potential malicious participants, making existing attack methods often ineffective when faced with these detector-enhanced systems. Therefore, how to design a target label attack method suitable for detector-enhanced vertical federated reasoning systems based on reasonable assumptions about attack background knowledge remains a research problem that needs to be solved urgently.

[0004] Existing target label attack techniques in vertical federated reasoning systems face the following two major problems: (1) Unrealistic attack knowledge assumptions: Existing technologies often assume that attackers can obtain labeled samples. However, in practice, attackers can only obtain the feature information of some samples and cannot effectively obtain the label information of the samples. In addition, existing technologies assume that attackers can obtain the output probability vector of the global inference model. However, in actual scenarios, this probability vector is highly private and therefore cannot be obtained by attackers.

[0005] (2) Ignoring the detector module in the reasoning system: Existing technologies often ignore the fact that in actual vertical federated reasoning systems, detector modules are usually deployed to identify malicious model inputs. When attack methods encounter these detector modules, they are often identified as malicious inputs, causing the attack to fail.

[0006] In view of this, the present invention is proposed. Summary of the Invention

[0007] The purpose of the present invention is to provide a target label attack method, device and medium for a vertical federated reasoning system, which can accumulate the output results of the inferred samples as pseudo labels during the reasoning process, thereby avoiding the attacker having to obtain labeled samples to achieve an effective target label attack, thereby solving the above-mentioned technical problems existing in the prior art.

[0008] The purpose of the present invention is achieved through the following technical solutions: A target label attack method for vertical federated reasoning systems with detector enhancement, including: The attacker's reasoning process is divided into the following two stages: In the preparation phase, the attacker executes the vertical federated reasoning process normally, accumulates the reasoning results fed back from the global vertical federated model of the federated reasoning system as pseudo labels, and uses the pseudo labels to train a local replacement model locally, while estimating the detector in the global vertical federated reasoning system; During the attack phase, the projected gradient descent method is used to optimize the input sample features to generate malicious samples, which are then input into the global longitudinal federated model of the federated reasoning system for target label attacks.

[0009] A processing device comprising: at least one memory for storing one or more programs; At least one processor is capable of executing one or more programs stored in the memory. When the one or more programs are executed by the processor, the processor is enabled to implement the method described in the present invention.

[0010] A readable storage medium stores a computer program, which can implement the method described in the present invention when the computer program is executed by a processor.

[0011] Compared with the prior art, the target label attack method, device, and medium for a vertical federated reasoning system provided by the present invention have the following beneficial effects: First, the method of the present invention takes into account the malicious input sample detectors deployed in actual vertical federated reasoning systems, and designs attack methods based on such actual reasoning systems, thereby making the method more practical.

[0012] Secondly, the method of the present invention does not rely on obtaining the probability confidence vector information output by the global model, nor does it need to master the true label information of some samples, which makes the attack assumptions more reasonable and in line with actual application scenarios.

[0013] Finally, the proposed method achieves a high attack success rate in practical applications. Specifically, after optimizing most test samples to malicious ones, it effectively causes the global federated model to incorrectly predict them as target labels. Therefore, this method has great potential for application, especially in scenarios where the attacker can control some input features.

[0014] Furthermore, the proposed method is simple in design, easy to implement, and applicable to a variety of vertical federated learning scenarios. Due to its minimal attack knowledge assumptions and design to mitigate detector evasion, the proposed method is widely applicable in data collaboration scenarios such as finance, healthcare, and smart cities. These fields often have strict requirements for data privacy and security, so the proposed method not only provides new attack vectors for these scenarios but also poses new security challenges. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 A flowchart of a target label attack method for a vertical federated reasoning system provided by an embodiment of the present invention.

[0017] Figure 2 A specific flow chart of the target label attack method for a vertical federated reasoning system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the specific content of the present invention. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments, and do not constitute a limitation of the present invention. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0019] First, the following terms may be used in this article: The term “and / or” means that either or both of them can be realized at the same time. For example, X and / or Y includes both “X” or “Y” and “X and Y”.

[0020] The terms "include," "comprises," "contains," "has," or other similar expressions should be interpreted as non-exclusive. For example, "including certain technical features (such as raw materials, components, ingredients, carriers, dosage forms, materials, dimensions, parts, components, mechanisms, devices, steps, procedures, methods, reaction conditions, processing conditions, parameters, algorithms, signals, data, products, or manufactured articles)" should be interpreted as including not only the technical features explicitly listed, but also other technical features known in the art that are not explicitly listed.

[0021] The term "consisting of" excludes any technical features not explicitly listed. If used in a claim, this term renders the claim closed, excluding any technical features other than those explicitly listed, except for conventional impurities associated with them. If this term appears only in a clause of a claim, it limits only the elements explicitly listed in that clause; elements listed in other clauses are not excluded from the claim as a whole.

[0022] Unless otherwise specified or limited, the terms "mounted," "connected," "connect," and "fixed" should be interpreted broadly. For example, they can refer to fixed, detachable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediary; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in this document based on specific circumstances.

[0023] When concentration, temperature, pressure, size or other parameters are expressed in the form of a numerical range, the numerical range should be understood to specifically disclose all ranges formed by the pairing of any upper limit, lower limit, or preferred value within the numerical range, regardless of whether the range is explicitly stated. For example, if a numerical range of "2 to 8" is stated, the numerical range should be interpreted as including ranges of "2 to 7," "2 to 6," "5 to 7," "3 to 4 and 6 to 7," "3 to 5 and 7," "2 and 5 to 7," etc. Unless otherwise specified, the numerical ranges stated herein include both their endpoints and all integers and fractions within the numerical range.

[0024] The terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings and are only for the convenience and simplification of description, and do not explicitly or implicitly indicate that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore should not be understood as a limitation to this document.

[0025] The scheme provided by the present invention is described in detail below. The contents not described in detail in the examples of the present invention belong to the prior art known to professionals in this field. If specific conditions are not specified in the examples of the present invention, they are carried out according to conventional conditions in the field or conditions recommended by the manufacturer. If the manufacturer of the reagents or instruments used in the examples of the present invention is not specified, they are all conventional products that can be purchased commercially.

[0026] like Figure 1 and Figure 2 As shown, an embodiment of the present invention provides a target label attack method for a vertical federated reasoning system, which is used in a vertical federated reasoning system with detector enhancement, including: The attacker's reasoning process is divided into the following two stages: In the preparation phase, the attacker executes the vertical federated reasoning process normally, accumulates the reasoning results fed back from the global vertical federated model of the federated reasoning system as pseudo labels, and uses the pseudo labels to train a local replacement model locally, while estimating the detector in the global vertical federated reasoning system; During the attack phase, projected gradient descent is used to optimize input sample features to generate malicious samples. These samples are then fed into the global longitudinal federated model of the federated inference system for a target label attack. These malicious samples are those that allow the local surrogate model to output the target category while also avoiding being identified as malicious by the locally estimated detector.

[0027] In the aforementioned preparation phase, the attacker honestly executes the vertical federated inference protocol, accumulating the inference results fed back from the global federated model as data pseudo-labels. Based on these pseudo-labels, the attacker can locally estimate the global true detector and train a local replacement model based on the data features it possesses.

[0028] Preferably, in the preparation phase of the above method, the attacker normally executes the vertical federation reasoning process in the following manner, and accumulates the reasoning results fed back from the global vertical federation model as pseudo labels, including: Step 11, semi-supervised clustering: The attacker uses a semi-supervised clustering algorithm to divide the entire test set into multiple data clusters. In step 11, the attacker first uses a semi-supervised clustering method (such as the Constrained Seeded KMeans clustering algorithm) to divide the entire test set into multiple clusters, such as C clusters. Because the attacker does not have additional label information during the initial clustering, the clustering process is consistent with the traditional standard KMeans clustering algorithm.

[0029] Step 12, sample selection: The attacker calculates the expressive power value of the unlabeled samples in each data cluster, and selects unlabeled samples in each data cluster based on the accuracy of the local substitution model and the expressive power value of the unlabeled samples; Specifically, within each cluster, the attacker selects samples with strong expressive power for subsequent standard vertical federated reasoning. The expressive power of a sample is determined by two metrics: distance similarity and probabilistic uncertainty. For unlabeled test samples, if they are closer to the inferred and pseudo-labeled data samples, they have stronger expressive power; if they can make the local surrogate model produce higher probabilistic uncertainty, the expressive power is also stronger. These two metrics are balanced through hyperparameters. In the early stages of vertical federated reasoning, due to the low accuracy of the local surrogate model, the attacker tends to select samples with higher probabilistic uncertainty. In the later stages, when the accuracy of the local surrogate model increases, the performance improvement effect of continuing to select samples with larger probabilistic uncertainty decreases, so the attacker is more inclined to select samples with greater distance similarity.

[0030] Step 13, standard vertical federated reasoning: The attacker inputs all the unlabeled samples selected in step 12 into the global longitudinal federated model for standard longitudinal federated inference. The attacker receives the inference results returned by the global longitudinal federated model and uses the inference results as pseudo labels for the corresponding unlabeled samples. Step 14: Update pseudo-label information: The attacker uses the pseudo labels of the unlabeled samples to update the clustering results according to step 11, and obtains multiple updated data clusters; The attacker uses the updated data clusters and, following steps 12 and 13, obtains the inference results for each unlabeled sample and uses them as pseudo-labels for the unlabeled sample. The attacker then combines the local sample features to generate pseudo-labeled samples to update the pseudo-label information. In this step, the attacker selects samples with strong expressiveness from all unlabeled test samples and honestly inputs these samples into the vertical federated inference process. During this process, the inference results of the global vertical federated model are returned to each participant. The attacker accumulates these inference results and uses them as pseudo-labels for the unlabeled test samples.

[0031] Preferably, in step 12 of the above method, the attacker calculates the unlabeled samples in each data cluster in the following manner: The expressive power value ,include: By distance similarity and probabilistic uncertainty Identify unlabeled samples The expressive power value , which determines the unlabeled samples The expressive power value The calculation formula is: ; in, To balance the distance similarity and probabilistic uncertainty Hyperparameters of these two indicators; distance similarity The calculation formula is: ; Probabilistic uncertainty The calculation formula is: ; Among them, distance similarity Used to measure unlabeled samples Samples that have been inferred and pseudo-labeled The distance size, The larger the number, the more unlabeled samples Samples that have been inferred and pseudo-labeled The smaller the distance is, the more unlabeled samples there are. Stronger expressive ability; is a pseudo-label sample set, i represents the sequence number of the pseudo-label sample in the pseudo-label sample set; is the attacker’s local model; probabilistic uncertainty Used to measure unlabeled samples Probabilistic uncertainty in local substitution models, The larger the value, the greater the uncertainty, indicating that there are no labeled samples. Stronger expressive ability; A local alternative model for the attacker; () represents the entropy of the vector; () represents a function used to calculate the classification probability vector.

[0032] Preferably, in step 12 of the above method, selecting unlabeled samples in each data cluster according to the accuracy of the local substitution model combined with the expressiveness value of the unlabeled samples is performed in the following manner, including: When the accuracy of the local replacement model is less than 50%, the attacker sets the probability uncertainty of all unlabeled samples to Sort the values in descending order and select the probability uncertainty The k samples with the largest values, k is a preset value. If k is 1, then The sample with the largest value and the hyperparameters used for balancing are set at the same time The value is less than 0.5; When the accuracy of the local replacement model is equal to or higher than 50%, the attacker sets the distance similarity of all unlabeled samples to Sort in descending order and select distance similarity from The k samples with the largest values and the hyperparameters used for balancing are set at the same time Value greater than 0.5.

[0033] Preferably, in the preparation phase of the above method, the attacker uses pseudo labels to locally train a local surrogate model while estimating the detector in the global longitudinal federated reasoning system in the following manner, including: In step 15, the attacker uses the pseudo-labeled samples to locally build an estimated detector and a local alternative model, which shares the same bottom model as the global longitudinal federation model but uses a randomly initialized inference head model; The attacker uses pseudo-labeled samples to train the estimated detector and local replacement model, and the training process will stop when the model accuracy reaches a threshold set by the attacker.

[0034] Preferably, in the attack phase of the above method, the attacker generates malicious samples by optimizing input sample features using the projected gradient descent method, and inputs the generated malicious samples into the global longitudinal federated model of the federated inference system to perform a target label attack, including: Step 21: Generate malicious samples: The attacker uses the projected gradient descent algorithm to iteratively optimize the inference samples using the local substitution model and estimated detector obtained in the preparation phase to generate the final malicious sample; Step 22, Malicious Vertical Federated Reasoning: The attacker inputs the generated malicious samples into the global longitudinal federated reasoning system, causing the global longitudinal federated model to predict any sample features input by other participants as the attacker's target label.

[0035] Preferably, in step 21 of the above method, the attacker generates a final malicious sample by iteratively optimizing the inference sample using the projected gradient descent algorithm using the local substitution model and the estimated detector obtained by training in the preparation phase in the following manner, including: The attacker inputs the remaining unlabeled samples in the test set into the local substitution model and the locally estimated detector, and uses the projected gradient descent algorithm for iterative optimization. The first optimization sub-goal is to make the local substitution model predict the unlabeled sample as the target label with a high confidence that meets the predetermined confidence level (generally, a prediction probability exceeding 0.8 can be considered as a high confidence level). The second optimization sub-goal is to ensure that the malicious samples generated after optimization can still be judged as normal samples by the locally estimated detector. The specific optimization objective function is for: ; in, represents an unlabeled sample; represents the cross entropy loss function; represents the attacker's target label; represents the local estimated detector; is a hyperparameter used to balance the two optimization sub-objectives during the optimization process.

[0036] An embodiment of the present invention further provides a processing device, comprising: at least one memory for storing one or more programs; At least one processor can execute one or more programs stored in the memory, and when the one or more programs are executed by the processor, the processor can implement the above method.

[0037] An embodiment of the present invention further provides a readable storage medium storing a computer program, which can implement the above method when executed by a processor.

[0038] In summary, the target label attack method provided by the embodiments of the present invention is a more practical target label attack solution and has at least the following advantages over the prior art: This method takes into account the malicious input sample detectors deployed in actual vertical federated reasoning systems and designs attack methods based on such actual reasoning systems, making the method more practical.

[0039] Secondly, this method does not rely on obtaining the probability confidence vector information output by the global model, nor does it need to master the true label information of some samples, which makes the attack assumptions more reasonable and in line with actual application scenarios.

[0040] Finally, this method achieves a high attack success rate in practical applications. Specifically, after optimizing most test samples to malicious ones, it effectively causes the global federated model to incorrectly predict them as target labels. Therefore, this method has great potential for application, especially in scenarios where the attacker can control some input features.

[0041] Furthermore, this method is simple and easy to implement, making it applicable to a variety of vertical federated learning scenarios. Due to its minimal attack knowledge assumptions and its design to mitigate detector evasion, it is widely applicable in data collaboration scenarios such as finance, healthcare, and smart cities. These fields often have strict requirements for data privacy and security, so the proposed method not only provides new attack vectors for these scenarios but also poses new security challenges.

[0042] In order to more clearly demonstrate the technical solution and technical effects provided by the present invention, the solution provided by the embodiment of the present invention is described in detail with reference to specific embodiments below.

[0043] Example 1 This embodiment provides a target label attack method for a vertical federated reasoning system. The process is as follows: Figure 1 As shown in the figure, this method does not require the attacker to obtain labeled samples and can effectively evade detection by the detector. Specifically, this method avoids the assumption that the attacker must obtain labeled samples by accumulating the output results of the inferred samples as pseudo labels during the inference process. Our method divides the inference process into two stages: in the preparation stage of the first stage, the attacker executes the inference process normally and uses pseudo labels to train a local replacement model locally, while estimating the detector module in the global inference system; in the attack stage of the second stage, the projected gradient descent technique is used to optimize the input sample features, so that the optimized features can not only enable the local replacement model to output the target category, but also avoid being identified as malicious samples by the locally estimated detector, and finally the optimized features are input into the federated inference system. This method can effectively solve the two major problems in the existing technology and provide a more practical and feasible method for target label attacks in vertical federated inference systems.

[0044] This method converts the attacker's complete reasoning process on the test set into Figure 2 As shown, it is divided into the preparation phase (see Figure 2 left part of the middle) and the attack phase (see Figure 2 the right part of the image).

[0045] In the preparation phase, the attacker accumulates the required attack knowledge and uses this knowledge to achieve more effective target label attacks in the attack phase. The specific process is as follows: (1) Preparation stage: In the preparation phase, the attacker honestly executes the vertical federated inference protocol, accumulating the inference results fed back from the global federated model as pseudo-labels. Based on these pseudo-labels, the attacker can locally estimate the global true detector and train a local replacement model based on the data features it has. This phase specifically includes the following steps: Step 11, semi-supervised clustering (see Figure 2 Steps corresponding to number ① in the figure): The attacker first uses a semi-supervised clustering method (such as the Constrained Seeded KMeans clustering algorithm) to divide the complete test set into Since the attacker does not have additional label information during the initial clustering, the clustering process is consistent with the traditional standard KMeans clustering algorithm.

[0046] Step 12, sample selection (see Figure 2 Steps corresponding to label ② in the figure): Within each data cluster, the attacker selects samples with stronger expressive power for subsequent standard vertical federated reasoning. The expressive power of a sample is determined by two indicators: distance similarity and probability uncertainty. For an unlabeled sample, if it is closer to the data sample that has been inferred and obtained pseudo-labels, the expressive power is stronger; if it can make the local alternative model produce higher probability uncertainty, the expressive power is also stronger. The relationship between these two indicators is determined by the hyperparameter In the early stages of vertical federated inference, due to the low accuracy of the local surrogate model, the attacker tends to select samples with higher probability uncertainty. However, in the later stages, when the accuracy of the local surrogate model improves, the performance improvement effect of continuing to select samples with larger probability uncertainty decreases, so the attacker is more inclined to select samples with greater distance similarity.

[0047] Step 13, standard vertical federated reasoning (see Figure 2 Steps corresponding to number ③ in the figure): In step ②, the attacker selects samples with strong expressive power from all unlabeled test samples and inputs all these samples into the vertical federated reasoning process. In this process, the reasoning results of the global vertical federated model are It will be returned to each participant, and the attacker accumulates these inference results as pseudo labels for unlabeled samples.

[0048] Step 14: Update pseudo-label information (see Figure 2 Steps corresponding to number ④ in the figure): After obtaining the inference result of each unlabeled sample, the attacker uses it as a pseudo-label for that sample and combines it with the local sample features to generate pseudo-labeled samples. As more local test samples are assigned pseudo-labels, the attacker can update the semi-supervised clustering process and use the newly obtained pseudo-label information to update the clustering results on the test set.

[0049] Step 15, local training (see Figure 2 Steps corresponding to label ⑤ in the figure): The attacker uses pseudo-labeled samples to locally build an estimated detector and a local surrogate model. This model shares the same underlying model as the global federated model but uses a randomly initialized inference head. The attacker then trains the estimated detector and local surrogate model using pseudo-labeled samples. Training stops when the model accuracy reaches a threshold set by the attacker.

[0050] (2) Attack phase: During the attack phase, the attacker intentionally deviates from the vertical federated inference protocol and uses gradient optimization to generate malicious samples with the help of a local surrogate model. Based on the estimated detector, the attacker ensures that the attack sample can evade the local detector. The attacker then migrates the generated malicious sample to the federated inference system, aiming to cause the global inference model to incorrectly predict the malicious sample as the target label. This phase consists of the following two sub-steps: Step 21, generate malicious samples (see Figure 2 Steps corresponding to number ⑥ in the figure): The attacker uses the projected gradient descent algorithm to iteratively optimize the inference samples with the help of the local substitute model and the estimated detector trained in the preparation phase, and finally generates malicious samples. The specific process is as follows: the attacker selects unlabeled samples with weaker expression ability from the test set and inputs them into the local substitute model and the local estimated detector at the same time. The optimization goal is to make the local substitute model predict the sample as the target label with high confidence, while ensuring that the optimized sample can still be judged as a normal sample by the local estimated detector. The two sub-goals in the optimization process are determined by the hyperparameters Balance.

[0051] Step 22, Malicious Vertical Federation Inference (see Figure 2 Steps corresponding to number ⑦ in the figure): When the optimization process is completed, the attacker inputs the generated malicious sample into the global longitudinal federated reasoning system. The goal is to make the global longitudinal federated model incorrectly predict the sample as the attacker's target label regardless of the sample features input by other honest participants.

[0052] Example 2 This embodiment provides a target label attack method for a vertical federated reasoning system. Figure 1 and Figure 2 ,include: Set the number of participants in the vertical federated reasoning system to 2; test set There are 6 test samples in total ,Right now Hyperparameters and are all set to 1; the number of data categories is 2; the attacker's target label is 0. The specific implementation steps are as follows: (1) Preparation stage: Step 11, semi-supervised clustering (see Figure 2 Steps corresponding to number ① in the figure): The attacker uses the Constrained Seed KMeans clustering algorithm to convert the complete test set Clustered into 2 data clusters, where the data cluster , data cluster .

[0053] Step 12, sample selection (see Figure 2 Steps corresponding to number ② in the figure): Calculate two data clusters and The expressive power value of each unlabeled sample in is obtained arrive The expressive power values of each unlabeled sample are: 0.8, 0.6, 0.4, 0.7, 0.3, 1.1. In the two data clusters, they are the data samples with the highest expression ability values, so was selected.

[0054] Step 13, standard vertical federated reasoning (see Figure 2 Steps corresponding to number ③ in the figure): The unlabeled samples Input into the global longitudinal federation model, and the prediction results of the two unlabeled samples are 0 and 1 respectively. The prediction results are used as Pseudo labels.

[0055] Step 14: Update pseudo-label information (see Figure 2 Steps corresponding to number ④ in the figure): Two data clusters and Unlabeled samples in and We have pseudo labels, so we can use the pseudo labels to update the clustering results. The clustering results we get back are and , the clustering obtained at this time is more accurate than the initialized clustering.

[0056] Step 15, local training (see Figure 2 Steps corresponding to label ⑤ in the figure): The unlabeled samples Combined with pseudo labels to form local test samples and , used to train the local substitution model and the local estimated detector. After 50 iterations, the local substitution model converges and the training is terminated.

[0057] (2) Attack phase: Step 21, generate malicious samples (see Figure 2 Steps corresponding to number ⑥ in the figure): The two data clusters and The remaining unlabeled samples, i.e. and Input into the local substitution model and estimated detector, and use the projected gradient descent algorithm to optimize these input samples to generate four malicious samples and .

[0058] Step 22, Malicious Vertical Federated Inference (see Figure 2 Steps corresponding to number ⑦ in the figure): The four malicious samples generated in step 21 and When input into the global vertical federation model, the predicted result is 0, 0, 0, 0. Ultimately, the attacker's attack success rate is 5 / 6 = 83.3%.

[0059] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a program. The program can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0060] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims. The information disclosed in the background technology section of this article is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as an admission or any form of implication that the information constitutes prior art already known to those skilled in the art.

Claims

1. A target label attack method for a vertical federated reasoning system, characterized by: Used in longitudinal federated reasoning systems with detector augmentation, including: The attacker's reasoning process is divided into the following two stages: In the preparation phase, the attacker executes the vertical federated reasoning process normally, accumulates the reasoning results fed back from the global vertical federated model of the federated reasoning system as pseudo labels, and uses the pseudo labels to train a local replacement model locally, while estimating the detector in the global vertical federated reasoning system; During the attack phase, the projected gradient descent method is used to optimize the input sample features to generate malicious samples, which are then input into the global longitudinal federated model of the federated reasoning system for target label attacks.

2. The target label attack method for a vertical federated reasoning system according to claim 1, characterized in that: In the preparation phase of the method, the attacker performs the vertical federation reasoning process normally in the following manner, accumulating the reasoning results fed back from the global vertical federation model as pseudo labels, including: Step 11, semi-supervised clustering: The attacker uses a semi-supervised clustering algorithm to divide the complete test set into multiple data clusters; Step 12, sample selection: The attacker calculates the expressive power value of the unlabeled samples in each data cluster, and selects unlabeled samples in each data cluster based on the accuracy of the local substitution model and the expressive power value of the unlabeled samples; Step 13, standard vertical federated reasoning: The attacker inputs all the unlabeled samples selected in step 12 into the global longitudinal federated model for standard longitudinal federated inference. The attacker receives the inference results returned by the global longitudinal federated model and uses the inference results as pseudo labels for the corresponding unlabeled samples. Step 14: Update pseudo-label information: The attacker uses the pseudo labels of the unlabeled samples to update the clustering results according to step 11, and obtains multiple updated data clusters; The attacker uses the updated multiple data clusters and, according to steps 12 and 13, obtains the inference results of each unlabeled sample and uses them as the pseudo-label of the unlabeled sample. The attacker also generates pseudo-label samples based on the local sample features to update the pseudo-label information.

3. The target label attack method for a vertical federated reasoning system according to claim 2, characterized in that: In step 11, the semi-supervised clustering method used is the Constrained Seed KMeans clustering algorithm.

4. The target label attack method for a vertical federated reasoning system according to claim 2, characterized in that: In step 12, the attacker calculates the unlabeled samples in each data cluster in the following way The expressive power value ,include: By distance similarity and probabilistic uncertainty Identify unlabeled samples The expressive power value , which determines the unlabeled samples The expressive power value The calculation formula is: ； in, To balance the distance similarity and probabilistic uncertainty Hyperparameters of these two indicators; distance similarity The calculation formula is: ; Probabilistic uncertainty The calculation formula is: ; Among them, distance similarity Used to measure unlabeled samples Samples that have been inferred and pseudo-labeled The distance size, The larger the number, the more unlabeled samples Samples that have been inferred and pseudo-labeled The smaller the distance is, the more unlabeled samples Stronger expressive ability; is a pseudo-label sample set, i represents the sequence number of the pseudo-label sample in the pseudo-label sample set; is the attacker’s local model; probabilistic uncertainty Used to measure unlabeled samples Probabilistic uncertainty in local substitution models, The larger the value, the greater the uncertainty, indicating that there are no labeled samples. Stronger expressive ability; A local alternative model for the attacker; () represents the entropy of the vector; () represents a function used to calculate the classification probability vector.

5. The target label attack method for a vertical federated reasoning system according to claim 4, characterized in that: In step 12, the unlabeled samples are selected in each data cluster according to the accuracy of the local substitution model combined with the expressiveness value of the unlabeled samples in the following manner, including: when the accuracy of the local substitution model is less than 50%, the attacker sets the probability uncertainty of all unlabeled samples to Sort the values in descending order and select the probability uncertainty The k samples with the largest values, k is the preset value, and the hyperparameters used for balancing are set at the same time The value is less than 0.5; When the accuracy of the local replacement model is equal to or higher than 50%, the attacker sets the distance similarity of all unlabeled samples to Sort in descending order and select distance similarity from The k samples with the largest values and the hyperparameters used for balancing are set at the same time Value greater than 0.

5.

6. The target label attack method for a vertical federated reasoning system according to any one of claims 2 to 5, characterized in that: In the preparation phase of the proposed method, the attacker uses pseudo labels to locally train a local surrogate model while estimating the detector in the global longitudinal federated reasoning system in the following manner: In step 15, the attacker uses the pseudo-labeled samples to locally build an estimated detector and a local alternative model. The local alternative model shares the same bottom model with the global longitudinal federated model, but uses a randomly initialized inference head model. The attacker uses the pseudo-labeled samples to train the estimated detector and the local alternative model. The training process will stop when the model accuracy reaches the threshold set by the attacker.

7. The target label attack method for a vertical federated reasoning system according to any one of claims 2 to 5, characterized in that: During the attack phase of the method, the attacker generates malicious samples by optimizing input sample features using the projected gradient descent method. The generated malicious samples are then fed into the global longitudinal federated model of the federated inference system to perform a target label attack, including: Step 21: Generate malicious samples: The attacker uses the projected gradient descent algorithm to iteratively optimize the inference samples using the local substitution model and estimated detector obtained in the preparation phase to generate the final malicious sample; Step 22, Malicious Vertical Federated Reasoning: The attacker inputs the generated malicious samples into the global longitudinal federated reasoning system, causing the global longitudinal federated model to predict any sample features input by other participants as the attacker's target label.

8. The target label attack method for a vertical federated reasoning system according to claim 7, characterized in that: In step 21, the attacker generates a final malicious sample by iteratively optimizing the inference sample using the projected gradient descent algorithm using the local substitution model and the estimated detector obtained by training in the preparation phase in the following manner, including: The attacker inputs the remaining unlabeled samples in the test set into the local substitution model and the locally estimated detector, and uses the projected gradient descent algorithm for iterative optimization. The first optimization sub-goal is to make the local substitution model predict the unlabeled sample as the target label with a high confidence that meets the predetermined confidence level. The second optimization sub-goal is to ensure that the malicious samples generated after optimization can still be judged as normal samples by the locally estimated detector. The specific optimization objective function is for: ； in, represents an unlabeled sample; represents the cross entropy loss function; represents the attacker's target label; represents the local estimated detector; is a hyperparameter used to balance the two optimization sub-objectives during the optimization process.

9. A processing device, characterized in that: include: at least one memory for storing one or more programs; At least one processor is capable of executing one or more programs stored in the memory, and when the one or more programs are executed by the processor, the processor is capable of implementing the method according to any one of claims 1 to 8.

10. A readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 can be implemented.

Images